On 21 October 2026, two critical security issues were found in PHP, the software that runs WordPress and most websites (CVE-2026-109618 and CVE-2026-109619). If left unpatched, they could let an attacker take control of a website without logging in. What we did We installed the fixed PHP versions (8.2.35, 8.3.36 and 8.4.27) on all Whostpress ...